USN-3938-1 — systemd vulnerability

Summary

Jann Horn discovered that pam_systemd created logind sessions using some
parameters from the environment. A local attacker could exploit this in
order to spoof the active session and gain additional PolicyKit
privileges.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	systemd	204-5ubuntu20.31
Ubuntu · 16.04 LTS 16.04:LTS	systemd	229-4ubuntu21.21
Ubuntu · 18.04 LTS 18.04:LTS	systemd	237-3ubuntu10.19

Vulnerabilities 1

Medium 4.5

CVE-2019-3842 Public exploit

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using …

The systemd Project systemd systemd systemd Debian Ubuntu

Apr 9, 2019

References

report
https://ubuntu.com/security/CVE-2019-3842

systemd vulnerability

Summary

Fixed packages 3

Vulnerabilities 1

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using …

References